itsrabbit[.]com

The domain itsrabbit.com is identified as a brand impersonation threat targeting Rabby, a cryptocurrency wallet service. Analysis indicates the domain was designed to deceive users into interacting with fraudulent content under the guise of the legitimate Rabby platform. Currently, the domain is offline, but prior activity suggests malicious intent aligned with crypto-related scams, potentially involving wallet-draining mechanisms or credential harvesting. Infrastructure analysis reveals the domain was registered on September 26, 2024, through NameCheap, Inc. and resolves to the IP address 104.21.93.27, which is proxied through Cloudflare. Security vendors flagged the domain in 6 of 95 VirusTotal scans, and it appears on one security blocklist. The trust score assigned by Gridinsoft is 0 out of 100, indicating high-risk classification. Detected technologies include Unpkg, Cloudflare Browser Insights, and HTTP/3, with an SSL certificate issued by Google Trust Services. The page title, SOL FLIP, suggests a focus on Solana-based cryptocurrency transactions, a common tactic in crypto-themed fraud. Given the domain's current offline status, immediate user interaction risks are mitigated. However, organizations and individuals should remain vigilant for similar impersonation attempts, particularly those leveraging cryptocurrency themes. It is recommended to monitor for re-registration or re-emergence of the domain under alternative names. Security teams should update blocklists to include this domain and its associated indicators, such as the resolved IP and SSL certificate issuer. Users should verify the authenticity of any Rabby-related communications or websites by cross-referencing official sources and avoiding interaction with unsolicited links.